Paper/Archive/CVE-2020-4682

CVE-2020-4682

IBM MQ — IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe…

EPSS 8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 94.5.945 × 2018.9 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

Affected

ProductAffectedFixed inSource

MQ8.0.0–CNA

MQ9.0.0–CNA

MQ9.1.0–CNA

MQ7.5.0–CNA

MQ9.2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ibm (CNA)8.1CVSS:3.0/AC:H/I:H/S:U/C:H/UI:N/A:H/AV:N/PR:N/RL:O/RC:C/E:U

References

refibm.com/support/pages/node/6408626 refexchange.xforce.ibmcloud.com/vulnerabilities/186509